feef7c585a67e368ce1a514158d6abc280e502b0408ad8b589d83687360ff11f

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2023 21:59

Target

3b0dce669a07626746d3b2301607702abd3bb2cba8dcb9c8b655f246e7b8ab1d.dll
Size

46KB
MD5

008675ad6fc2ed2b17cd19dfadc0e766
SHA1

0f1420ba4c089b7a0b07427058af8e15a4f59346
SHA256

3b0dce669a07626746d3b2301607702abd3bb2cba8dcb9c8b655f246e7b8ab1d
SHA512

ee9a455c5da82e29b3944f5d84db240e60298980311b0da09c53c50b20cfa6fa4fd9bd26562838e6a0442a5b043724351a39bc67803aa90c7f8e1330c8f84413
SSDEEP

768:DDJTV0YbZiAbYZSesRQxqz5qzGI4reLkfLe48tfpFtJoTpH6Ri:fJTV0QkNuQx252GI4ReHtLDApaE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2388 3288 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2388	3288	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1488 wrote to memory of 3288	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 3288	1488	rundll32.exe	rundll32.exe
PID 1488 wrote to memory of 3288	1488	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b0dce669a07626746d3b2301607702abd3bb2cba8dcb9c8b655f246e7b8ab1d.dll, DllRegisterServer
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b0dce669a07626746d3b2301607702abd3bb2cba8dcb9c8b655f246e7b8ab1d.dll, DllRegisterServer
  2⤵
  PID:3288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 600
    3⤵
    - Program crash
    PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3288 -ip 3288
1⤵
PID:3956